WCF net.tcp over internet without changing firewall settings?

Question

I have a Client and a Host application. The Client can send messages and gets callback messages back.

I use this code to create the duplex channel on the client side:

proxy = DuplexChannelFactory<IMonitor>.CreateChannel(new InstanceContext(this), new NetTcpBinding(SecurityMode.None), new EndpointAddress(endpoint));

On the Host application I self-host the service:

using (ServiceHost host = new ServiceHost(typeof(MonitorImpl.Monitor), new Uri(uri)))
{
    host.Open();
    Console.WriteLine("Service is hosted, has the following endpoints.");
    host.Description.Endpoints.ToList().ForEach(end => Console.WriteLine(end.Address));

    return Console.ReadLine();
}

As you may have noticed I have a Project named: MonitorImpl that contains the class Monitor. This class contains the code of the methods I use to call the service and the callback methods.

This program works locally and if I open the port on the computer hosting the host application, it also works on 2 different computers (in the same network).

My question is: How can I make this work on 2 different computers (over the internet) without having to change things to the firewall at the computer which is hosting the application? Am I going to need to change to type of binding to something else and if so... to what? Do I need to change the way or place I create the duplex channel? Anything else?

score 1 · Answer 1 · answered Aug 19 '14 at 14:23

1

No matter which binding you use, duplex or not, or even whether you are even hosting a WCF service or any other kind of application that listens on a TCP or UDP socket: You always have to make sure that the host's firewall accepts incoming connections on the port that the service listens to. Any sane firewall configuration blocks incoming connections by default.

The only way to get around this is to tunnel over a VPN or some kind of proxy service for which the firewall already has an open port.

answered Aug 19 '14 at 14:23

chris

2,541
1
23
40

My original plan was to have the host set up a duplex connection so this firewall would think it was ok (because he sent it himself?) and would be able to get messages back but somewhere along the road I seem to have turned it around... But at least I have some new options to research now, thanks for your message @chris! – kdno_be Aug 19 '14 at 14:30
Well, even with a duplex binding, the connection has to be initiated by the client. If it were the other way round, things would get even more complicated because the _client_ would have to listen on a socket, open a port on the firewall etc. Let alone NAT traversal problems. Duplex bindings were created for _avoiding_ just that. – chris Aug 19 '14 at 17:24

score 0 · Answer 2 · answered Nov 13 '14 at 08:12

You can use the duplex bindings to prevent needing to open ports on the CLIENT. Your host will still need to be exposed for the client to initiate the communications. You need to have something open on one end so the other can call it to start the process

WCF net.tcp over internet without changing firewall settings?

2 Answers2